9.8

CVE-2020-5723

Exploit
The UCM6200 series 1.0.20.22 and below stores unencrypted user passwords in an SQLite database. This could allow an attacker to retrieve all passwords and possibly gain elevated privileges.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Grandstream ≫ Ucm6202 Firmware Version < 1.0.20.22
   Grandstream ≫ Ucm6202 Version-
Grandstream ≫ Ucm6204 Firmware Version < 1.0.20.22
   Grandstream ≫ Ucm6204 Version-
Grandstream ≫ Ucm6208 Firmware Version < 1.0.20.22
   Grandstream ≫ Ucm6208 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 51.79% 0.978
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-312 Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.